Providers and data recipients

01

What this notice means

Popriva is operated by Lost Hills LLC, doing business as Popriva, with public mailing address 1480 Colorado Blvd, Ste 200A #209, Los Angeles, CA 90041, United States. Contact [email protected] about recipients or processing arrangements.

This notice supplements our Privacy Policy. Some integrations are available only when enabled for your service. A provider may process information on our instructions for specified work or act independently for its own legal, security or platform purposes. Its role depends on the particular activity; this notice does not classify every recipient as a subprocessor.

02

Application hosting, database and backups

Our application is hosted in the United States. Authorized infrastructure services process the account, workspace, campaign, booking, support and operational records needed to host and operate it, along with relevant connection/security logs. Storage and backup services process records and files for controlled storage, recovery and delivery. Access is limited to the service and authorized administration. Other integrations may process information outside the United States; US application hosting is not a promise that every recipient uses only US systems.

03

Object and cached media storage

Authorized storage services handle profile images, avatars, portfolio or campaign assets and associated file/request metadata to store, protect and deliver that content to authorized users. Recovery copies support restoration after a failure. Our retention policy and access controls apply to these copies as appropriate; storage is not a reason to make private assets unrestricted public content.

04

Loops and Resend email

We use Loops where enabled for launch-list contact management, transactional delivery and permission-based email workflows. Relevant data includes email address, name or role where used, consent/preferences, lifecycle attributes needed for the selected workflow, message content and delivery or suppression events.

Where Resend is used for authentication email, it receives the recipient address, sender information and message content, including the verification or reset link needed to send that message. Only the provider serving the relevant delivery needs that content. Email-provider settings and the applicable provider notice govern any provider-operated delivery functionality.

05

Stripe payments and payouts

Where payment features are enabled, Stripe processes payment and payout onboarding information and related risk/compliance information. We exchange account/transaction identifiers, amounts, currency, status and necessary booking context to administer payment, transfers, refunds and reconciliation. Stripe may act on our instructions for some activities and independently for regulatory, risk and other purposes under its terms. Applicable Stripe services and country coverage determine whether a particular payment or payout is available.

06

TikTok connections and embedded media

When you connect TikTok, TikTok handles authorization and receives requests for the data permitted by your granted scopes. We receive the authorized profile, recent-video and metric fields described in our Privacy Policy to maintain the connection and show relevant creator/work information.

Embedded TikTok players communicate directly with TikTok when loaded. TikTok receives browser connection/device information and may use its own storage under its privacy and cookie notices. Its independent account and platform purposes are separate from the information it supplies for your Popriva connection. See our Cookies notice for current embed behavior and controls.

07

Support and sound analytics

Where support chat is enabled, our hosted support system uses Chatwoot software to process selected account/profile/workspace context, messages, attachments and conversation metadata needed to handle a request. Historical chat records can remain after the widget is disabled and are included in assisted privacy-request handling. The use of that software does not by itself mean the vendor’s separate cloud service receives your conversations.

Where sound analytics is enabled, its service receives relevant sound/video identifiers and performance observations to monitor selected sounds and produce campaign reports. It does not need account passwords or unrelated payment credentials for that purpose. Availability depends on the reporting feature in use.

08

Other participants and recipients

Authorized artist workspace members and creators receive the relevant marketplace information needed to arrange and perform bookings. Authorized staff access information for review, support, security and finance within their responsibilities. Regulators, courts and professional advisers may receive necessary information when legally justified. Creator commission rates, loyalty tiers and net earnings are private financial information and are not disclosed to artists through discovery or booking views.

09

Locations, contracts and changes

We use providers for defined functions and assess the relevant processing, retention, access and transfer requirements. Where applicable law requires a transfer safeguard, we use an appropriate lawful arrangement. Contact [email protected] for information about the arrangements applicable to your data. A recipient notice does not itself obtain consent for every use.

If a separate signed business data processing agreement applies to a service where Popriva acts as a processor, that agreement governs applicable subprocessor authorization, change notices and objections. We update this notice for material recipient changes and provide further notices or choices when required.